Penetration Testing Methodologies Explained: OSSTMM, PTES and NIST

A penetration testing methodology gives an engagement structure, so results are repeatable and coverage is defensible. PenTest+ expects you to recognise the main ones and know which suits which kind of test.

The methodologies

Methodology	Focus
OSSTMM	Operational security measurement across five channels
PTES	End-to-end engagement process, seven phases
NIST SP 800-115	Technical assessment guidance, four phases
OWASP WSTG / MASTG	Web and mobile application testing
ISSAF	Detailed technical assessment framework
MITRE ATT&CK	Adversary behaviour catalogue, used for threat-informed testing

OSSTMM

The Open Source Security Testing Methodology Manual, from ISECOM. Its distinguishing feature is that it aims to measure operational security rather than produce a list of findings.

It defines five channels, and the breadth is the thing to remember: human (social engineering), physical, wireless, telecommunications, and data networks. Most methodologies cover only the last; OSSTMM treats a building's doors and a receptionist's willingness to help as testable security controls in the same framework as a firewall.

It produces a RAV — Risk Assessment Value — a numerical measure of attack surface, which allows comparison over time and between sites. That quantitative emphasis is what distinguishes it, and it suits organisations that want to track security posture as a metric rather than as a series of reports.

The trade-off is complexity. OSSTMM is rigorous and demanding to apply fully.

PTES

The Penetration Testing Execution Standard is the one that maps most directly onto how engagements actually run, and its seven phases are worth learning in order:

Pre-engagement interactions — scope, rules of engagement, authorisation.
Intelligence gathering — OSINT and reconnaissance.
Threat modelling — identifying assets and relevant threats.
Vulnerability analysis — finding weaknesses.
Exploitation — confirming they are exploitable.
Post-exploitation — pivoting, persistence, assessing impact.
Reporting — findings, evidence and remediation guidance.

Two things the exam draws from this. The engagement begins and ends with non-technical work — authorisation at the front, reporting at the back — and those bookends are where engagements succeed or fail. And post-exploitation is a distinct phase: demonstrating what an attacker could reach matters more than the initial exploit.

NIST SP 800-115

US federal guidance, and the most commonly cited in compliance contexts. Four phases: planning, discovery, attack, and reporting, with a feedback loop from attack back into discovery as new information emerges.

Its value is that it is a recognised government standard, so referencing it satisfies auditors.

OWASP testing guides

The Web Security Testing Guide and Mobile Application Security Testing Guide are checklists of specific tests by category — authentication, session management, input validation, business logic and so on.

They are not full engagement methodologies; they are what you use inside the vulnerability analysis and exploitation phases when the target is an application. The related OWASP ASVS defines verification levels that a test can be measured against.

Choosing one

Use PTES for a general engagement structure. Use OSSTMM when the scope spans physical, human and wireless as well as networks, or when a repeatable metric is wanted. Use NIST SP 800-115 where a recognised standard is required for compliance. Use OWASP guides for application testing detail. Use ATT&CK when the test is threat-informed — emulating a specific adversary's techniques.

In practice engagements combine them: PTES for phases, OWASP for application test cases, ATT&CK to describe what was done.

Why methodology matters beyond the exam

Without one, coverage depends on the tester's habits, two testers produce incomparable reports, gaps are invisible because nobody knows what was not tested, and there is no defensible answer to "was this thorough".

A stated methodology also protects the tester. If the scope and approach were agreed against a recognised standard, "you did not test X" has a documented answer.

Testing perspectives

Worth pairing with methodology, since exams ask for both. Unknown environment (black box) means no prior information, simulating an external attacker and spending significant time on reconnaissance. Known environment (white box) provides full documentation and source, giving the most thorough coverage per hour. Partially known (grey box) sits between, and is the common commercial choice.

What to remember

OSSTMM measures operational security across human, physical, wireless, telecommunications and data network channels, producing a RAV. PTES defines seven phases from pre-engagement through post-exploitation to reporting. NIST SP 800-115 has four phases and carries compliance weight. OWASP guides supply application test detail rather than engagement structure. Authorisation and reporting bracket every methodology.

Related reading: SOW, MSA and rules of engagement · Adversary emulation · OWASP Top 10